“Australian-hosted” has become one of the most common phrases in AI marketing. It sounds reassuring, and for many businesses it’s the first question they ask before letting AI near client data. But it can mean very different things depending on who’s saying it.
This explainer covers what data sovereignty actually involves, why “hosted in an Australian region” isn’t always the same as “under Australian control”, and the questions worth asking any AI provider before you send them your data.
Data residency vs data sovereignty
Two ideas often get blurred together:
- Data residency is about where your data physically sits: which country, which data centre.
- Data sovereignty is about whose laws and whose control your data is subject to. That depends not just on where the servers are, but on who owns and operates them, and which governments can compel that company to hand data over.
A provider can offer excellent data residency (your data never leaves Sydney) while sovereignty remains more complicated, because the company running those servers answers to a foreign legal system.
What “Australian region” usually means
The large global cloud and AI providers operate data centres in Australia, and many let you choose an Australian region. That’s genuinely useful: it can reduce latency and keep data at rest onshore.
But there are some things worth checking:
- Where is the model actually run? Some services store your files in Australia while prompts are processed elsewhere. Read the fine print on where inference happens, not just storage.
- Where do logs, telemetry and abuse monitoring go? Prompts and outputs may be retained for safety review or debugging, sometimes in another country.
- Who can access it for support? “Follow the sun” support teams may be able to access systems from overseas.
- Which company is the contracting party? If it’s a foreign parent company, foreign law may reach your data regardless of where it’s stored.
The US CLOUD Act
The US Clarifying Lawful Overseas Use of Data Act, passed in 2018 and usually called the CLOUD Act, allows US authorities, with appropriate legal process, to require US-based technology providers to produce data in their possession, custody or control, even when that data is stored outside the United States.
In practical terms, data held by a US-headquartered provider in an Australian data centre may still be reachable under US law. Australia and the United States have also signed an agreement under the CLOUD Act framework that supports cross-border access to data for serious crime investigations.
For most businesses, the realistic risk of a foreign government request is low. But if you handle sensitive client, health, legal or government information, or you’ve made commitments to clients about where their data goes, it matters who ultimately controls the infrastructure, not just where it sits.
Australian privacy law: APP 8
If your business is covered by the Privacy Act 1988, Australian Privacy Principle 8 deals with cross-border disclosure of personal information. Broadly, before you disclose personal information to an overseas recipient, you need to take reasonable steps to ensure that recipient doesn’t breach the Australian Privacy Principles. In many cases your business remains accountable for what the overseas recipient does with that information.
Sending customer data to an overseas AI service for processing can bring APP 8 into play. The OAIC’s APP 8 guidelines explain how it applies. This is an area where it’s worth getting your own legal advice, but the short version is: know where personal information goes, and be able to show you’ve thought about it.
DeepSeek and the government’s response
In February 2025, the Department of Home Affairs issued a direction requiring Australian Government entities to remove DeepSeek products, applications and web services from government systems and devices, citing an unacceptable level of security risk.
The direction applies to government, not private businesses. But it’s a useful reminder that where an AI provider is based, and which laws it operates under, are now mainstream security considerations. Many businesses have since reviewed which AI tools their staff use and where those tools send data.
Questions to ask any AI provider
Whoever you’re considering, these questions cut through the marketing:
- Where are prompts and outputs processed, not just stored?
- Is any data retained, and for how long? Is it used to train models?
- Who owns and operates the infrastructure? Is the contracting company Australian, or a subsidiary of a foreign parent?
- Which foreign laws could compel access to our data?
- Where are logs, backups and support staff located?
- Can we get these commitments in the contract, not just on the website?
- Whose certifications are they? A data centre’s ISO 27001 or SOC 2 report covers the facility operator. Ask whether the AI provider running inside it holds its own, and what it covers.
Your options, from most to least control
There’s no single right answer. It depends on how sensitive your data is and what you’ve promised your clients.
- On-premise AI. A model running on hardware inside your own office or network. Data never leaves your building. It’s best for highly sensitive workloads, with more upfront setup.
- Australian-owned, Australian-hosted AI. Infrastructure that is located in Australia and run by an Australian company, which keeps both residency and control onshore.
- Global providers in an Australian region. Strong residency, with sovereignty depending on the provider’s corporate structure and contract terms.
- Global providers, global processing. Often the most capable and convenient, but with the least control over where data goes.
Many businesses end up using a mix: a mainstream provider for low-risk tasks, and Australian-hosted or on-premise AI for anything involving client or personal information.
How Code Squirrel can help
We’re a Brisbane-based software and AI team, and we’ve built our AI offering around these questions.
- Squirrel AI is frontier AI on our own servers in NEXTDC’s Tier IV B2 Brisbane data centre, with a second Victorian data centre for disaster recovery, zero data retention and no training on your data. Plans start from $149/month ex. GST.
- In-Office AI puts a private model on your own hardware, inside your network, for work that can’t leave the building.
- If you’re not sure what you need, our AI readiness assessment reviews your data, privacy and compliance obligations and maps out where AI fits.
To be straight about certifications: NEXTDC’s B2 Brisbane facility is Uptime Institute Tier IV certified, NEXTDC holds ISO 27001 certification for its data centre operations, and SOC 1 and SOC 2 Type II and PCI DSS across its data centres. Code Squirrel isn’t ISO 27001 certified itself, but we work with clients who are and have helped clients achieve certification.
Book a free 30-minute chat with an engineer and we’ll give you a straight answer about where your data should live.
